Akira, LockBit actively searching for vulnerable Cisco ASA devices

CVE-2020-3259 is an information-disclosure vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software, caused by a buffer-tracking error when the device parses invalid URLs. An unauthenticated, remote attacker can trigger it by sending a crafted GET request to the web services interface, which allows retrieval of the device's memory contents and disclosure of confidential information. Only devices with specific AnyConnect and WebVPN configurations are affected, but those configurations are common on ASA/FTD firewalls deployed as enterprise edge and remote-access VPN gateways. Exploitation is confirmed in the wild: CISA added the bug to its Known Exploited Vulnerabilities catalog on 2024-02-15 with known ransomware use, and the Akira ransomware group (which the FBI says has extorted $42 million across roughly 250 attacks since March 2023) is actively exploiting it, with LockBit also scanning for vulnerable Cisco ASA devices. EPSS assigns a 71.8% probability of exploitation within 30 days, and no public proof-of-concept code is known.

Do: Upgrade affected ASA and FTD devices to the fixed releases listed in Cisco's security advisory for CVE-2020-3259; if patching is delayed, disable or restrict the web services interface (WebVPN/AnyConnect) to trusted source networks. Per the CISA KEV required action, apply vendor mitigations or discontinue use where mitigations are unavailable. Prioritize internet-facing VPN gateways and hunt for exploitation indicators (anomalous GET requests to the web services interface) given active Akira and LockBit targeting.

CVE-2020-3580 is a cross-site scripting (XSS) flaw caused by insufficient validation of user-supplied input in the web services interface of Cisco ASA and Firepower Threat Defense (FTD) software. An unauthenticated, remote attacker can exploit it by persuading a user of the web interface to click a crafted link, which then executes arbitrary script code in the context of the interface or exposes sensitive browser-based information such as session data. Only devices running specific AnyConnect and WebVPN configurations are affected, so not every ASA/FTD deployment is vulnerable. The flaw is under active exploitation: it is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, a public PoC exploit has driven scanning, and groups such as Akira and LockBit are actively searching for vulnerable Cisco ASA devices.

Do: Apply updates per the vendor's instructions (Cisco's advisory lists the fixed ASA/FTD releases), prioritizing internet-facing devices since ransomware operators (Akira, LockBit) are actively scanning. Check whether the web services interface (AnyConnect/WebVPN) is enabled, as only those configurations are vulnerable, and restrict internet access to the device's management/web interface where possible. Treat as urgent given its KEV listing and known ransomware use.